{"api_version":"1","generated_at":"2026-08-07T08:01:28+00:00","cve":"CVE-2025-23150","urls":{"html":"https://cve.report/CVE-2025-23150","api":"https://cve.report/api/cve/CVE-2025-23150.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2025-23150","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2025-23150"},"summary":{"title":"ext4: fix off-by-one error in do_split","description":"In the Linux kernel, the following vulnerability has been resolved:\n\next4: fix off-by-one error in do_split\n\nSyzkaller detected a use-after-free issue in ext4_insert_dentry that was\ncaused by out-of-bounds access due to incorrect splitting in do_split.\n\nBUG: KASAN: use-after-free in ext4_insert_dentry+0x36a/0x6d0 fs/ext4/namei.c:2109\nWrite of size 251 at addr ffff888074572f14 by task syz-executor335/5847\n\nCPU: 0 UID: 0 PID: 5847 Comm: syz-executor335 Not tainted 6.12.0-rc6-syzkaller-00318-ga9cda7c0ffed #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/30/2024\nCall Trace:\n <TASK>\n __dump_stack lib/dump_stack.c:94 [inline]\n dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120\n print_address_description mm/kasan/report.c:377 [inline]\n print_report+0x169/0x550 mm/kasan/report.c:488\n kasan_report+0x143/0x180 mm/kasan/report.c:601\n kasan_check_range+0x282/0x290 mm/kasan/generic.c:189\n __asan_memcpy+0x40/0x70 mm/kasan/shadow.c:106\n ext4_insert_dentry+0x36a/0x6d0 fs/ext4/namei.c:2109\n add_dirent_to_buf+0x3d9/0x750 fs/ext4/namei.c:2154\n make_indexed_dir+0xf98/0x1600 fs/ext4/namei.c:2351\n ext4_add_entry+0x222a/0x25d0 fs/ext4/namei.c:2455\n ext4_add_nondir+0x8d/0x290 fs/ext4/namei.c:2796\n ext4_symlink+0x920/0xb50 fs/ext4/namei.c:3431\n vfs_symlink+0x137/0x2e0 fs/namei.c:4615\n do_symlinkat+0x222/0x3a0 fs/namei.c:4641\n __do_sys_symlink fs/namei.c:4662 [inline]\n __se_sys_symlink fs/namei.c:4660 [inline]\n __x64_sys_symlink+0x7a/0x90 fs/namei.c:4660\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n </TASK>\n\nThe following loop is located right above 'if' statement.\n\nfor (i = count-1; i >= 0; i--) {\n\t/* is more than half of this entry in 2nd half of the block? */\n\tif (size + map[i].size/2 > blocksize/2)\n\t\tbreak;\n\tsize += map[i].size;\n\tmove++;\n}\n\n'i' in this case could go down to -1, in which case sum of active entries\nwouldn't exceed half the block size, but previous behaviour would also do\nsplit in half if sum would exceed at the very last block, which in case of\nhaving too many long name files in a single block could lead to\nout-of-bounds access and following use-after-free.\n\nFound by Linux Verification Center (linuxtesting.org) with Syzkaller.","state":"PUBLISHED","assigner":"Linux","published_at":"2025-05-01 13:15:50","updated_at":"2026-07-30 06:22:16"},"problem_types":["CWE-193"],"metrics":[{"version":"3.1","source":"nvd@nist.gov","type":"Primary","score":"5.5","severity":"MEDIUM","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"}},{"version":"3.1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","score":"7.8","severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"}},{"version":"3.1","source":"CNA","type":"DECLARED","score":"7.8","severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","data":{"baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}}],"references":[{"url":"https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html","name":"https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/17df39f455f1289319d4d09e4826aa46852ffd17","name":"https://git.kernel.org/stable/c/17df39f455f1289319d4d09e4826aa46852ffd17","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/2883e9e74f73f9265e5f8d1aaaa89034b308e433","name":"https://git.kernel.org/stable/c/2883e9e74f73f9265e5f8d1aaaa89034b308e433","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/35d0aa6db9d93307085871ceab8a729594a98162","name":"https://git.kernel.org/stable/c/35d0aa6db9d93307085871ceab8a729594a98162","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/94824ac9a8aaf2fb3c54b4bdde842db80ffa555d","name":"https://git.kernel.org/stable/c/94824ac9a8aaf2fb3c54b4bdde842db80ffa555d","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/ab0cc5c25552ae0d20eae94b40a93be11b080fc5","name":"https://git.kernel.org/stable/c/ab0cc5c25552ae0d20eae94b40a93be11b080fc5","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/515c34cff899eb5dae6aa7eee01c1295b07d81af","name":"https://git.kernel.org/stable/c/515c34cff899eb5dae6aa7eee01c1295b07d81af","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/2eeb1085bf7bd5c7ba796ca4119925fa5d336a3f","name":"https://git.kernel.org/stable/c/2eeb1085bf7bd5c7ba796ca4119925fa5d336a3f","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html","name":"https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/16d9067f00e3a7d1df7c3aa9c20d214923d27e10","name":"https://git.kernel.org/stable/c/16d9067f00e3a7d1df7c3aa9c20d214923d27e10","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/b96bd2c3db26ad0daec5b78c85c098b53900e2e1","name":"https://git.kernel.org/stable/c/b96bd2c3db26ad0daec5b78c85c098b53900e2e1","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-23150","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-23150","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected ea54176e5821936d109bb45dc2c19bd53559e735 b96bd2c3db26ad0daec5b78c85c098b53900e2e1 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 5872331b3d91820e14716632ebb56b1399b34fe1 515c34cff899eb5dae6aa7eee01c1295b07d81af git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 5872331b3d91820e14716632ebb56b1399b34fe1 2883e9e74f73f9265e5f8d1aaaa89034b308e433 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 5872331b3d91820e14716632ebb56b1399b34fe1 35d0aa6db9d93307085871ceab8a729594a98162 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 5872331b3d91820e14716632ebb56b1399b34fe1 2eeb1085bf7bd5c7ba796ca4119925fa5d336a3f git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 5872331b3d91820e14716632ebb56b1399b34fe1 16d9067f00e3a7d1df7c3aa9c20d214923d27e10 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 5872331b3d91820e14716632ebb56b1399b34fe1 17df39f455f1289319d4d09e4826aa46852ffd17 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 5872331b3d91820e14716632ebb56b1399b34fe1 ab0cc5c25552ae0d20eae94b40a93be11b080fc5 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 5872331b3d91820e14716632ebb56b1399b34fe1 94824ac9a8aaf2fb3c54b4bdde842db80ffa555d git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 059b1480105478c5f68cf664301545b8cad6a7cf git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 539ae3e03875dacaa9c388aff141ccbb4ef4ecb5 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected fbbfd55a40d5d0806b59ee0403c75d5ac517533f git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected b3ddf6ba5e28a57729fff1605ae08e21be5c92e3 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected e50fe43e3062e18846e99d9646b9c07b097eb1ed git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 88e79f7a9841278fa8ff7ff6178bad12da002ffc git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 5.4.61 5.4.293 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 4.4.234 4.5 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 4.9.234 4.10 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 4.14.195 4.15 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 4.19.142 4.20 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 5.7.18 5.8 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 5.8.4 5.9 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 5.9","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 5.9 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 5.4.293 5.4.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 5.10.237 5.10.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 5.15.181 5.15.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.1.135 6.1.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.6.88 6.6.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.12.24 6.12.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.13.12 6.13.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.14.3 6.14.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.15 * original_commit_for_fix","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2025","cve_id":"23150","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"linux","cpe5":"linux_kernel","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2025-11-03T19:42:46.918Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"url":"https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html"},{"url":"https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html"}],"title":"CVE Program Container"},{"metrics":[{"other":{"content":{"id":"CVE-2025-23150","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-06-10T20:41:10.502771Z","version":"2.0.3"},"type":"ssvc"}}],"providerMetadata":{"dateUpdated":"2026-06-11T18:44:09.529Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"title":"CISA ADP Vulnrichment"}],"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/ext4/namei.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"b96bd2c3db26ad0daec5b78c85c098b53900e2e1","status":"affected","version":"ea54176e5821936d109bb45dc2c19bd53559e735","versionType":"git"},{"lessThan":"515c34cff899eb5dae6aa7eee01c1295b07d81af","status":"affected","version":"5872331b3d91820e14716632ebb56b1399b34fe1","versionType":"git"},{"lessThan":"2883e9e74f73f9265e5f8d1aaaa89034b308e433","status":"affected","version":"5872331b3d91820e14716632ebb56b1399b34fe1","versionType":"git"},{"lessThan":"35d0aa6db9d93307085871ceab8a729594a98162","status":"affected","version":"5872331b3d91820e14716632ebb56b1399b34fe1","versionType":"git"},{"lessThan":"2eeb1085bf7bd5c7ba796ca4119925fa5d336a3f","status":"affected","version":"5872331b3d91820e14716632ebb56b1399b34fe1","versionType":"git"},{"lessThan":"16d9067f00e3a7d1df7c3aa9c20d214923d27e10","status":"affected","version":"5872331b3d91820e14716632ebb56b1399b34fe1","versionType":"git"},{"lessThan":"17df39f455f1289319d4d09e4826aa46852ffd17","status":"affected","version":"5872331b3d91820e14716632ebb56b1399b34fe1","versionType":"git"},{"lessThan":"ab0cc5c25552ae0d20eae94b40a93be11b080fc5","status":"affected","version":"5872331b3d91820e14716632ebb56b1399b34fe1","versionType":"git"},{"lessThan":"94824ac9a8aaf2fb3c54b4bdde842db80ffa555d","status":"affected","version":"5872331b3d91820e14716632ebb56b1399b34fe1","versionType":"git"},{"status":"affected","version":"059b1480105478c5f68cf664301545b8cad6a7cf","versionType":"git"},{"status":"affected","version":"539ae3e03875dacaa9c388aff141ccbb4ef4ecb5","versionType":"git"},{"status":"affected","version":"fbbfd55a40d5d0806b59ee0403c75d5ac517533f","versionType":"git"},{"status":"affected","version":"b3ddf6ba5e28a57729fff1605ae08e21be5c92e3","versionType":"git"},{"status":"affected","version":"e50fe43e3062e18846e99d9646b9c07b097eb1ed","versionType":"git"},{"status":"affected","version":"88e79f7a9841278fa8ff7ff6178bad12da002ffc","versionType":"git"},{"lessThan":"5.4.293","status":"affected","version":"5.4.61","versionType":"semver"},{"lessThan":"4.5","status":"affected","version":"4.4.234","versionType":"semver"},{"lessThan":"4.10","status":"affected","version":"4.9.234","versionType":"semver"},{"lessThan":"4.15","status":"affected","version":"4.14.195","versionType":"semver"},{"lessThan":"4.20","status":"affected","version":"4.19.142","versionType":"semver"},{"lessThan":"5.8","status":"affected","version":"5.7.18","versionType":"semver"},{"lessThan":"5.9","status":"affected","version":"5.8.4","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/ext4/namei.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.9"},{"lessThan":"5.9","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.4.*","status":"unaffected","version":"5.4.293","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.237","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.181","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.135","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.88","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.24","versionType":"semver"},{"lessThanOrEqual":"6.13.*","status":"unaffected","version":"6.13.12","versionType":"semver"},{"lessThanOrEqual":"6.14.*","status":"unaffected","version":"6.14.3","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"6.15","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"5.4.293","versionStartIncluding":"5.4.61","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"5.10.237","versionStartIncluding":"5.9","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"5.15.181","versionStartIncluding":"5.9","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.1.135","versionStartIncluding":"5.9","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.6.88","versionStartIncluding":"5.9","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.12.24","versionStartIncluding":"5.9","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.13.12","versionStartIncluding":"5.9","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.14.3","versionStartIncluding":"5.9","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.15","versionStartIncluding":"5.9","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.4.234","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.9.234","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.14.195","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.19.142","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.7.18","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.8.4","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\next4: fix off-by-one error in do_split\n\nSyzkaller detected a use-after-free issue in ext4_insert_dentry that was\ncaused by out-of-bounds access due to incorrect splitting in do_split.\n\nBUG: KASAN: use-after-free in ext4_insert_dentry+0x36a/0x6d0 fs/ext4/namei.c:2109\nWrite of size 251 at addr ffff888074572f14 by task syz-executor335/5847\n\nCPU: 0 UID: 0 PID: 5847 Comm: syz-executor335 Not tainted 6.12.0-rc6-syzkaller-00318-ga9cda7c0ffed #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/30/2024\nCall Trace:\n <TASK>\n __dump_stack lib/dump_stack.c:94 [inline]\n dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120\n print_address_description mm/kasan/report.c:377 [inline]\n print_report+0x169/0x550 mm/kasan/report.c:488\n kasan_report+0x143/0x180 mm/kasan/report.c:601\n kasan_check_range+0x282/0x290 mm/kasan/generic.c:189\n __asan_memcpy+0x40/0x70 mm/kasan/shadow.c:106\n ext4_insert_dentry+0x36a/0x6d0 fs/ext4/namei.c:2109\n add_dirent_to_buf+0x3d9/0x750 fs/ext4/namei.c:2154\n make_indexed_dir+0xf98/0x1600 fs/ext4/namei.c:2351\n ext4_add_entry+0x222a/0x25d0 fs/ext4/namei.c:2455\n ext4_add_nondir+0x8d/0x290 fs/ext4/namei.c:2796\n ext4_symlink+0x920/0xb50 fs/ext4/namei.c:3431\n vfs_symlink+0x137/0x2e0 fs/namei.c:4615\n do_symlinkat+0x222/0x3a0 fs/namei.c:4641\n __do_sys_symlink fs/namei.c:4662 [inline]\n __se_sys_symlink fs/namei.c:4660 [inline]\n __x64_sys_symlink+0x7a/0x90 fs/namei.c:4660\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n </TASK>\n\nThe following loop is located right above 'if' statement.\n\nfor (i = count-1; i >= 0; i--) {\n\t/* is more than half of this entry in 2nd half of the block? */\n\tif (size + map[i].size/2 > blocksize/2)\n\t\tbreak;\n\tsize += map[i].size;\n\tmove++;\n}\n\n'i' in this case could go down to -1, in which case sum of active entries\nwouldn't exceed half the block size, but previous behaviour would also do\nsplit in half if sum would exceed at the very last block, which in case of\nhaving too many long name files in a single block could lead to\nout-of-bounds access and following use-after-free.\n\nFound by Linux Verification Center (linuxtesting.org) with Syzkaller."}],"metrics":[{"cvssV3_1":{"baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}}],"providerMetadata":{"dateUpdated":"2026-07-30T05:48:46.940Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/b96bd2c3db26ad0daec5b78c85c098b53900e2e1"},{"url":"https://git.kernel.org/stable/c/515c34cff899eb5dae6aa7eee01c1295b07d81af"},{"url":"https://git.kernel.org/stable/c/2883e9e74f73f9265e5f8d1aaaa89034b308e433"},{"url":"https://git.kernel.org/stable/c/35d0aa6db9d93307085871ceab8a729594a98162"},{"url":"https://git.kernel.org/stable/c/2eeb1085bf7bd5c7ba796ca4119925fa5d336a3f"},{"url":"https://git.kernel.org/stable/c/16d9067f00e3a7d1df7c3aa9c20d214923d27e10"},{"url":"https://git.kernel.org/stable/c/17df39f455f1289319d4d09e4826aa46852ffd17"},{"url":"https://git.kernel.org/stable/c/ab0cc5c25552ae0d20eae94b40a93be11b080fc5"},{"url":"https://git.kernel.org/stable/c/94824ac9a8aaf2fb3c54b4bdde842db80ffa555d"}],"title":"ext4: fix off-by-one error in do_split","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2025-23150","datePublished":"2025-05-01T12:55:38.190Z","dateReserved":"2025-01-11T14:28:41.513Z","dateUpdated":"2026-07-30T05:48:46.940Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2025-05-01 13:15:50","lastModifiedDate":"2026-07-30 06:22:16","problem_types":["CWE-193"],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-06-10T20:41:10.502771Z","id":"CVE-2025-23150","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.4.234","versionEndExcluding":"4.5","matchCriteriaId":"828A2CDB-B224-45AA-9561-4FCB1D464807"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.9.234","versionEndExcluding":"4.10","matchCriteriaId":"1CA6F6DB-8D68-4032-86B2-DAF5F766ACE8"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.14.195","versionEndExcluding":"4.15","matchCriteriaId":"95AB963D-E230-42F5-B369-0B44029D2718"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.19.142","versionEndExcluding":"4.20","matchCriteriaId":"DC87236D-0EFA-41DF-BBE9-FF75394EBBD3"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.4.61","versionEndExcluding":"5.4.293","matchCriteriaId":"272803FC-25EE-4BB2-A85A-B7B4ABE3DE5F"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.7.18","versionEndExcluding":"5.8","matchCriteriaId":"8141C666-AECC-41B8-BD7E-DED92216B4A5"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.8.4","versionEndExcluding":"5.9","matchCriteriaId":"560FB3D4-80AB-415C-96DA-0097E0BCB36F"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.9.1","versionEndExcluding":"5.10.237","matchCriteriaId":"6CC99F84-24B3-4B7B-AB04-D917F7E74F8D"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.11","versionEndExcluding":"5.15.181","matchCriteriaId":"12331C9E-F601-4EFC-899E-369F98DCC70B"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.16","versionEndExcluding":"6.1.135","matchCriteriaId":"5B9ACE29-7445-4B6F-B761-6367C005E275"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.2","versionEndExcluding":"6.6.88","matchCriteriaId":"6E5947E5-45E3-462A-829B-382B3B1C61BD"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.7","versionEndExcluding":"6.12.24","matchCriteriaId":"1D35A8A8-F3EC-45E6-AD37-1F154B27529D"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.13","versionEndExcluding":"6.13.12","matchCriteriaId":"4A475784-BF3B-4514-81EE-49C8522FB24A"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.14","versionEndExcluding":"6.14.3","matchCriteriaId":"483E2E15-2135-4EC6-AB64-16282C5EF704"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:5.9:-:*:*:*:*:*:*","matchCriteriaId":"F79A2EB6-623E-4749-AEE0-DCB58C4C42F8"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:5.9:rc2:*:*:*:*:*:*","matchCriteriaId":"A67F6509-9592-44D5-8C65-B0791C7A501A"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:5.9:rc3:*:*:*:*:*:*","matchCriteriaId":"A52A4ABE-5C24-4CD4-A348-E303B7F23C71"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:5.9:rc4:*:*:*:*:*:*","matchCriteriaId":"12019CF2-FD8E-4D59-BA4C-7093DF0BB091"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:5.9:rc5:*:*:*:*:*:*","matchCriteriaId":"9B1AB90E-C0C6-4027-B27D-BA214BE33561"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:5.9:rc6:*:*:*:*:*:*","matchCriteriaId":"103FE5BA-7315-4263-9C95-EABEAD7E174F"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:5.9:rc7:*:*:*:*:*:*","matchCriteriaId":"47E31D6A-31EC-4F63-9CAE-B7A52B58E149"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:5.9:rc8:*:*:*:*:*:*","matchCriteriaId":"3497462B-A3DA-47CC-A5DD-C1C2D2E6DFDE"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:6.15:rc1:*:*:*:*:*:*","matchCriteriaId":"8D465631-2980-487A-8E65-40AE2B9F8ED1"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*","matchCriteriaId":"FA6FEEC2-9F11-4643-8827-749718254FED"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2025","CveId":"23150","Ordinal":"1","Title":"ext4: fix off-by-one error in do_split","CVE":"CVE-2025-23150","Year":"2025"},"notes":[{"CveYear":"2025","CveId":"23150","Ordinal":"1","NoteData":"In the Linux kernel, the following vulnerability has been resolved:\n\next4: fix off-by-one error in do_split\n\nSyzkaller detected a use-after-free issue in ext4_insert_dentry that was\ncaused by out-of-bounds access due to incorrect splitting in do_split.\n\nBUG: KASAN: use-after-free in ext4_insert_dentry+0x36a/0x6d0 fs/ext4/namei.c:2109\nWrite of size 251 at addr ffff888074572f14 by task syz-executor335/5847\n\nCPU: 0 UID: 0 PID: 5847 Comm: syz-executor335 Not tainted 6.12.0-rc6-syzkaller-00318-ga9cda7c0ffed #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/30/2024\nCall Trace:\n <TASK>\n __dump_stack lib/dump_stack.c:94 [inline]\n dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120\n print_address_description mm/kasan/report.c:377 [inline]\n print_report+0x169/0x550 mm/kasan/report.c:488\n kasan_report+0x143/0x180 mm/kasan/report.c:601\n kasan_check_range+0x282/0x290 mm/kasan/generic.c:189\n __asan_memcpy+0x40/0x70 mm/kasan/shadow.c:106\n ext4_insert_dentry+0x36a/0x6d0 fs/ext4/namei.c:2109\n add_dirent_to_buf+0x3d9/0x750 fs/ext4/namei.c:2154\n make_indexed_dir+0xf98/0x1600 fs/ext4/namei.c:2351\n ext4_add_entry+0x222a/0x25d0 fs/ext4/namei.c:2455\n ext4_add_nondir+0x8d/0x290 fs/ext4/namei.c:2796\n ext4_symlink+0x920/0xb50 fs/ext4/namei.c:3431\n vfs_symlink+0x137/0x2e0 fs/namei.c:4615\n do_symlinkat+0x222/0x3a0 fs/namei.c:4641\n __do_sys_symlink fs/namei.c:4662 [inline]\n __se_sys_symlink fs/namei.c:4660 [inline]\n __x64_sys_symlink+0x7a/0x90 fs/namei.c:4660\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n </TASK>\n\nThe following loop is located right above 'if' statement.\n\nfor (i = count-1; i >= 0; i--) {\n\t/* is more than half of this entry in 2nd half of the block? */\n\tif (size + map[i].size/2 > blocksize/2)\n\t\tbreak;\n\tsize += map[i].size;\n\tmove++;\n}\n\n'i' in this case could go down to -1, in which case sum of active entries\nwouldn't exceed half the block size, but previous behaviour would also do\nsplit in half if sum would exceed at the very last block, which in case of\nhaving too many long name files in a single block could lead to\nout-of-bounds access and following use-after-free.\n\nFound by Linux Verification Center (linuxtesting.org) with Syzkaller.","Type":"Description","Title":"ext4: fix off-by-one error in do_split"}]}}}